# kern 0.9.0-rc3

> SQL checked against your schema at compile time (E0311). The engine moves inside the language.

Source: https://kern-lang.eu/releases/0.9.0-rc3

SQL checked against your schema at compile time (E0311)

May 16, 2026

## Release notes

## v0.9.0-rc3, SQL checked against your schema at compile time (E0311)

Injection prevention stops a query built from user input from type-checking. The typechecker now goes one step further and validates the SQL itself against your declared schema, before the program runs. A query against a table that does not exist, or a `SELECT` / `INSERT` naming a column that is not in that table, is a compile error (`E0311`): not a 500 in production at 2am. The whole class of “typo in a column name” and “migration drifted from the code” bugs moves from runtime to `kern build`. Combined with the `@sql_literal` rule, a Kern SQL statement is checked for both injection safety and schema correctness at the same compile step.

## v0.9.0-rc3, a self-contained container engine (no docker, no podman)

The container subsystem used to shell out to a host Docker or Podman. It is now a complete OCI engine compiled into the language. It pulls and runs real images (`debian:bookworm-slim`, `alpine:3.19`) with nothing on the host but the Kern binary, a Linux kernel 5.15 or newer, and libc. No docker, podman, runc, crun, skopeo, iptables, nft or iproute2 required. HTTPS and tar extraction run in-tree (vendored mbedTLS plus a statically linked libarchive).

Network setup is hand-rolled netlink (`RTM_NEWLINK` / `NEWADDR` / `NEWROUTE`), and outbound NAT installs an `inet kern_nat` nftables table directly over `NFNETLINK_NFT`. `oci_pull_image_verified()` checks a cosign-compatible Ed25519 signature and pins the manifest digest. A build gate (`make check-container-no-shellout`) fails if `popen` or `system` appears in the container runtime sources, and a CI leg apt-purges every shellout binary before running the suite under an `strace execve` tripwire.

[Read the announcement: kern v0.9.0-rc3, the engine moves inside the language ](https://kern-lang.eu/blog/v090-rc3-release)